Re: strange authorizer behavior

 There are functions called in your example whose source you don't
supply so I can't test this myself and say for sure what's wrong.

 I will note that you have to be careful with with-http-body. The body
forms may not be executed thus you shouldn't depend on the
return value as you do here:

		       (with-http-body (req ent)
                                          :done)

 I'd suggest that you trace  net.aserve::authorize while
the request is given to see what value is returned.  If :done
were not returned after you've sent back a response then
you could see what you're seeing (multiple responses for the same
request).